redline | 642bf61f9656120b91dbf8bc03a404e0dad352de35f472a646609c1721f3cdfe

General

Target

_@vasyapupkin198_crypted.exe
Size

2.4MB
MD5

1017e8c87e171726d22c64c7ea74c127
SHA1

2ab6e439c75a7dd6848834c7a648cec91731f568
SHA256

642bf61f9656120b91dbf8bc03a404e0dad352de35f472a646609c1721f3cdfe
SHA512

3d1a1805622a5fb449030f4ef5a568655e78b5b1f3cb29a25df211effca05c29c366088a530f00c96774088e4ca90116831ef9077ba979467df5462baf1ce7b4

Score

10^/10

redline infostealer spyware

Malware Config

Extracted

Family

redline

C2

185.215.113.83:60722

Attributes

auth_value
9b369b35de96e42580e664d13a1927dc

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/215152-131-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

_@vasyapupkin198_crypted.exe

description pid process target process

PID 4776 set thread context of 215152 4776 _@vasyapupkin198_crypted.exe AppLaunch.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AppLaunch.exe

pid process

215152 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 215152 AppLaunch.exe

description	pid	process	target process
PID 4776 set thread context of 215152	4776	_@vasyapupkin198_crypted.exe	AppLaunch.exe

pid	process
215152	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	215152	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

_@vasyapupkin198_crypted.exe

description	pid	process	target process
PID 4776 wrote to memory of 215152	4776	_@vasyapupkin198_crypted.exe	AppLaunch.exe
PID 4776 wrote to memory of 215152	4776	_@vasyapupkin198_crypted.exe	AppLaunch.exe
PID 4776 wrote to memory of 215152	4776	_@vasyapupkin198_crypted.exe	AppLaunch.exe
PID 4776 wrote to memory of 215152	4776	_@vasyapupkin198_crypted.exe	AppLaunch.exe
PID 4776 wrote to memory of 215152	4776	_@vasyapupkin198_crypted.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\_@vasyapupkin198_crypted.exe
"C:\Users\Admin\AppData\Local\Temp\_@vasyapupkin198_crypted.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:215152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/215152-130-0x0000000000000000-mapping.dmp

Download
memory/215152-131-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/215152-136-0x0000000005AB0000-0x00000000060C8000-memory.dmp

Filesize
6.1MB

Download
memory/215152-137-0x0000000005550000-0x0000000005562000-memory.dmp

Filesize
72KB

Download
memory/215152-138-0x0000000005680000-0x000000000578A000-memory.dmp

Filesize
1.0MB

Download
memory/215152-139-0x00000000055D0000-0x000000000560C000-memory.dmp

Filesize
240KB

Download
memory/215152-140-0x0000000006680000-0x0000000006C24000-memory.dmp

Filesize
5.6MB

Download
memory/215152-141-0x00000000060D0000-0x0000000006162000-memory.dmp

Filesize
584KB

Download
memory/215152-142-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/215152-143-0x0000000006570000-0x00000000065E6000-memory.dmp

Filesize
472KB

Download
memory/215152-144-0x0000000006C30000-0x0000000006C4E000-memory.dmp

Filesize
120KB

Download
memory/215152-145-0x0000000008FA0000-0x0000000009162000-memory.dmp

Filesize
1.8MB

Download
memory/215152-146-0x00000000096A0000-0x0000000009BCC000-memory.dmp

Filesize
5.2MB

Download
memory/215152-147-0x0000000008220000-0x0000000008270000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing